[cs-raj]

Summary

Snyk Code flagged hardcoded values in unit-test fixtures ("Hardcoded Non-Cryptographic Secret" and "Use of Hardcoded Passwords"). All of them were dummy test values, not real credentials. This replaces them with the approved placeholders from the team's "Standard Approved Dummy Secrets" doc.

Snyk Code on development before: 15 findings. After this change: 10 test-file findings cleared; 5 remain, all in src/ (see Notes).

Changes (test files only, no source changes)

Property	Placeholder
apiKey	API_KEY / STACK_API_KEY (kept distinct in tokens-remove.test.ts)
access_token	ACCESS_TOKEN
password	PASSWORD
MFA test secrets (valid base32 required)	SECRET / TOKEN

• Assertions that depended on the old values (expected token option strings in tokens-remove.test.ts) are updated with them.
• pnpm-lock.yaml refreshed.

Testing

@contentstack/cli-utilities: 199 passing with the changes. @contentstack/cli-auth tests are run separately (needs cli-command built).
Snyk Code (snyk test --code --all-project) confirms the 10 test findings are gone.

Notes / out of scope

The 5 remaining findings are in source code and intentionally untouched here:

• contentstack-utilities/src/encrypter.ts:14 and :27 (default encryption key and scrypt salt; changing them would break decryption of existing stored data)
• contentstack-utilities/src/helpers.ts:119 and :121 (error-message label map, false positive)
• contentstack-utilities/src/auth-handler.ts:147 (http.createServer for the local OAuth callback)

🤖 Generated with Claude Code

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	90	25	✅ Passed
🟡 Medium Severity	1	79	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	1	90 / 365 days	⚠️ Warning
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 90
• Medium without fixes: 79
• Low without fixes: 0

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.

[github-actions]

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type	Count (with fixes)	Without fixes	Threshold	Result
🔴 Critical Severity	0	0	10	✅ Passed
🟠 High Severity	0	90	25	✅ Passed
🟡 Medium Severity	1	79	500	✅ Passed
🔵 Low Severity	0	0	1000	✅ Passed

⏱️ SLA Breach Summary

⚠️ Warning: The following vulnerabilities have exceeded their SLA thresholds (days since publication).

Severity	Breaches (with fixes)	Breaches (no fixes)	SLA Threshold (with/no fixes)	Status
🔴 Critical	0	0	15 / 30 days	✅ Passed
🟠 High	0	0	30 / 120 days	✅ Passed
🟡 Medium	0	1	90 / 365 days	⚠️ Warning
🔵 Low	0	0	180 / 365 days	✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

• Critical without fixes: 0
• High without fixes: 90
• Medium without fixes: 79
• Low without fixes: 0

⚠️ BUILD PASSED WITH WARNINGS - SLA breaches detected for issues without available fixes

Consider reviewing these vulnerabilities when fixes become available.